Nie można włączyć systemu

[piotrifek]

Więc jest taki problem : Nie mogę uruchomić systemu windows gdyż przy starcie wyskakuje kilka błędów między innymi :
system nie może odnaleźć pliku C:/Windows/win32/digeste.dll
wystąpił błąd w procesie "explorer.exe" - więc nic niemoge na nim zrobić
wystąpił błąd w procesie "Proxy" - wydaje mi sie że przez to niemogę sie połączyć z internetem

Komputer nie jest mój ale mojego ojca w biurze niemiał on żadnego antywirusa, dziś skanowałem go combofixem i hijackthis jak trzeba to podam logi

chciałem tam również zainstalować kaspersky'iego ale wyskakuje błąd że administrator nie pozwolił na wykonanie tej instalacji

próbowałem sie dostać do plików przez Linuxa - live CD ale komputer wtedy wariował nie dało sie nic zrobić bo kursor wracał wciąż do rogu ekranu i wyskakiwało mnóstwo okien

komputera nie dało sie przywrócić do ustawień z przed paru dni kiedy to było dobrze bo niema on ustawionej funkcji zapisu stanu

Jest szansa zrobić coś z tym bez formatowania dysku??

[sgsman]

Wrzuć więc logi.

[piotrifek]

combofix

Kod: Zaznacz wszystko

ComboFix 09-01-12.03 - Agroimpex 2009-02-08 14:23:40.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.447.293 [GMT 1:00]
Running from: e:\anty\ComboFix.exe

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.
- REDUCED FUNCTIONALITY MODE -
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Microsoft Common
c:\program files\Microsoft Common\svchost.exe
c:\windows\IE4 Error Log.txt
c:\windows\msauc.exe
c:\windows\system32\crypts.dll
c:\windows\system32\cssrss.exe
c:\windows\system32\digeste.dll
c:\windows\system32\drivers\services.exe
c:\windows\system32\drivers\str.sys
c:\windows\wiaserviv.log

.
(((((((((((((((((((((((((   Files Created from 2009-01-08 to 2009-02-08  )))))))))))))))))))))))))))))))
.

2009-02-08 14:23 . 2009-02-08 14:23   179,200   --a------   c:\windows\system32\perfmon.dll
2009-02-05 14:49 . 2009-02-05 14:49   179,200   --a------   c:\windows\system32\ntsd.dll
2009-02-05 14:44 . 2009-02-05 14:44   179,200   --a------   c:\windows\system32\PDFCreatorMessages.dll
2009-02-05 14:09 . 2009-02-05 14:09   3,584   --a------   c:\windows\rzikcjex.exe
2009-02-05 14:08 . 2009-02-05 14:08   163,652   --a------   c:\windows\system32\wpv741233833799.cpx
2009-02-05 14:08 . 2009-02-05 14:09   138,336   --a------   c:\windows\system32\drivers\ethdgdwd.sys
2009-02-05 14:08 . 2009-02-05 14:08   82,432   --a------   c:\windows\system32\wpv941232642399.cpx
2009-02-05 14:08 . 2009-02-05 14:08   75,776   --a------   c:\windows\system32\wpv661232642331.cpx
2009-02-05 14:08 . 2009-02-05 14:08   31,232   --a------   c:\windows\system32\wpv631232659547.cpx
2009-02-05 14:08 . 2009-02-05 14:08   30,848   --a------   c:\windows\system32\drivers\uhmhets.sys
2009-02-05 14:08 . 2009-02-05 14:08   5,120   --a------   c:\windows\system32\MKNRPG.syz
2009-02-05 14:08 . 2009-02-05 14:08   3,584   --a------   c:\windows\plotvsvn.exe
2009-02-05 14:08 . 2009-02-05 14:08   12   --a------   c:\windows\system32\shell31.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-05 13:55   6,656   ----a-w   c:\windows\system32\drivers\aec.sys
2009-02-05 13:44   360,320   ----a-w   c:\windows\system32\drivers\tcpip.sys
2009-02-05 13:10   1,136,128   ----a-w   c:\windows\explorer.exe
2009-02-05 12:43   ---------   d-----w   c:\documents and settings\Agroimpex\Dane aplikacji\Skype
2009-02-05 08:43   ---------   d-----w   c:\documents and settings\Agroimpex\Dane aplikacji\skypePM
2008-12-11 11:57   333,184   ----a-w   c:\windows\system32\drivers\srv.sys
2008-02-28 11:57   32   ----a-w   c:\documents and settings\All Users\Dane aplikacji\ezsid.dat
2008-02-01 17:37   471,040   ----a-w   c:\program files\PDFClient.exe
2008-02-01 17:37   380,928   ----a-w   c:\program files\ToPDF.exe
2008-02-01 17:34   61,440   ----a-w   c:\program files\ShutdownClients.exe
2008-01-31 13:46   977,408   ----a-w   c:\program files\JawsPowerPointMacro.ppa
2008-01-25 10:32   1,121,280   ----a-w   c:\program files\JawsPdfCreator.dot
2008-01-25 10:30   1,313,280   ----a-w   c:\program files\JawsExcelMacro.xla
2008-01-02 10:57   36,075,808   ----a-w   c:\documents and settings\Agroimpex\NAV071400.exe
2007-12-19 08:39   1,780,329   ----a-w   c:\program files\manual.pdf
2007-09-18 08:04   31,314   ----a-w   c:\program files\pdfcreator.ppd
2007-04-16 15:54   23,552   ----a-w   c:\windows\system32\config\systemprofile\svchost.exe
2007-04-16 15:54   23,552   ----a-w   c:\documents and settings\Agroimpex\svchost.exe
2006-05-03 19:24   2,155   -c--a-w   c:\program files\docnames.txt
2006-05-03 19:24   119,259   ----a-w   c:\program files\PDFCreator.chm
.

------- Sigcheck -------

2006-04-20 13:18  360576  b2220c618b42a2212a59d91ebd6fc4b4   c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 17:53  360832  64798ecfa43d78c7178375fcdd16d8c8   c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 11:44  360960  744e57c99232201ae98c49168b918f48   c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 12:51  361600  9aefa14bd6b182d61e3119fa5f436d3d   c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 12:59  361600  ad978a1b783b5719720cff204b666c8e   c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2001-10-30 13:00  327168  e7774698bb0d14b0710a9a31e209f9b6   c:\windows\$NtServicePackUninstall$\tcpip.sys
2004-08-03 22:14  359040  9f4b36614a0fc234525ba224957de55c   c:\windows\$NtUninstallKB917953$\tcpip.sys
2006-04-20 12:51  359808  1dbf125862891817f374f407626967f4   c:\windows\$NtUninstallKB941644$\tcpip.sys
2007-10-30 18:20  360064  90caff4b094573449a0872a0f919b178   c:\windows\$NtUninstallKB951748$\tcpip.sys
2004-08-03 22:14  359040  9f4b36614a0fc234525ba224957de55c   c:\windows\ServicePackFiles\i386\tcpip.sys
2008-04-13 20:20  361344  93ea8d04ec73a85db02eb8805988f733   c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\tcpip.sys
2008-06-20 11:45  360320  2a5554fc5b1e04e131230e3ce035c3f9   c:\windows\system32\dllcache\tcpip.sys
2009-02-05 14:44  360320  a8a6c5b80cb4b619d1a41892eee69e11   c:\windows\system32\drivers\tcpip.sys

2009-02-05 14:10  1136128  af2594d92c30547f44bdc00eb463cc3e   c:\windows\explorer.exe
2007-06-13 14:12  1034752  8db0650b211425b9cdb7d1c4a8f6b482   c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2001-10-30 13:00  1002496  0b6cb4abb3166e1717bda7895f2029d8   c:\windows\$NtServicePackUninstall$\explorer.exe
2004-08-03 23:44  1033728  379098a96e6c165b659de7e4328010ea   c:\windows\$NtUninstallKB938828$\explorer.exe
2004-08-03 23:44  1033728  379098a96e6c165b659de7e4328010ea   c:\windows\ServicePackFiles\i386\explorer.exe
2008-04-14 18:21  1035264  c791ed9eac5e76d9525e157b1d7a599a   c:\windows\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\explorer.exe
2009-02-05 14:10  1136128  af2594d92c30547f44bdc00eb463cc3e   c:\windows\system32\dllcache\explorer.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-08 94208]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904]
"Skype"="d:\program files\Skype\Phone\Skype.exe" [2008-02-06 21898024]
"plotvsvn.exe"="c:\windows\plotvsvn.exe" [2009-02-05 3584]
"rzikcjex.exe"="c:\windows\rzikcjex.exe" [2009-02-05 3584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-10-10 7286784]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-10-10 86016]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InstantAccess"="c:\program files\ScannerU\TBRIDGE\BIN\InstantAccess.exe" [1998-07-08 37376]
"RegisterDropHandler"="c:\program files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe" [1998-07-08 22528]
"PDFCreatorClient"="c:\program files\PDFClient.exe" [2008-02-01 471040]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352]
"nwiz"="nwiz.exe" [2005-10-10 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 c:\windows\RTHDCPL.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"RegisterDropHandler"="c:\program files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe" [1998-07-08 22528]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\Agroimpex\Menu Start\Programy\Autostart\
userinit.exe [2007-04-16 23552]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Action Manager 32.lnk - c:\program files\ScannerU\AM32.exe [2006-12-15 57344]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696]
Jaws PDF Creator Manual.lnk - c:\program files\manual.pdf [2008-05-16 1780329]
Jaws ToPDF.lnk - c:\program files\ToPDF.exe [2008-05-16 380928]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,c:\windows\system32\drivers\services.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.DIV3"= DivXc32.dll
"VIDC.DIV4"= DivXc32f.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.VP31"= vp31vfw.dll
"VIDC.MPG4"= msmpeg4.dll
"VIDC.MP42"= msmpeg4.dll
"VIDC.MP43"= msmpeg4.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"msacm.imc"= imc32.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages   REG_MULTI_SZ      msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders   msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\wpv631232659547.cpx"=

S1 ethdgdwd;ethdgdwd;c:\windows\system32\drivers\ethdgdwd.sys [2009-02-05 138336]
S3 MusCDriverV32;MusCDriverV32;c:\windows\system32\drivers\MusCDriverV32.sys [2007-12-21 513152]
S3 MusCVideo32;MusCVideo32;c:\windows\system32\drivers\MusCVideo32.sys [2007-12-21 3768]
S4 ahscyqcv;ahscyqcv;c:\windows\system32\drivers\uhmhets.sys [2009-02-05 30848]
S4 BulkUsb;Plustek USB Scanner;c:\windows\system32\drivers\usbscan.sys [2006-10-09 15104]
S4 OkiPar;OkiPar;c:\windows\system32\drivers\OkiPar.Sys [2006-10-09 40192]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NWEReboot - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.pl/
uInternet Connection Wizard,ShellNext = iexplore
IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {D10E5EE9-AB12-45E4-A538-9B097E618BEC} = 194.204.159.1,194.204.152.34

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

c:\windows\Downloaded Program Files\Solitaire.dll - O16 -: {112857FE-03FF-11D5-9A3F-0080C8D85044}
hxxp://67.15.101.3/g_bin/pl/solitaire_2_0_0_26.cab
c:\windows\Downloaded Program Files\Solitaire.inf

c:\windows\Downloaded Program Files\MakaoV2.dll - O16 -: {2A781DED-C22D-4153-9812-CEA98A32981C}
hxxp://67.15.101.3/g_bin/pl/cardsmakao_2_0_0_26.cab
c:\windows\Downloaded Program Files\MakaoV2.inf

c:\windows\Downloaded Program Files\Navy.dll - O16 -: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64}
hxxp://67.15.101.3/g_bin/pl/navy_2_0_0_27.cab
c:\windows\Downloaded Program Files\Navy.inf

c:\windows\Downloaded Program Files\Makao.dll - O16 -: {881290B9-F53C-4676-8DAF-3DBEFC297308}
hxxp://67.15.101.3/g_bin/pl/makao_2_0_0_22.cab
c:\windows\Downloaded Program Files\Makao.inf

c:\windows\Downloaded Program Files\Pirate.dll - O16 -: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A}
hxxp://67.15.101.3/g_bin/pl/pirate_2_0_0_28.cab
c:\windows\Downloaded Program Files\Pirate.inf

c:\windows\Downloaded Program Files\Marbles.dll - O16 -: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B}
hxxp://67.15.101.3/g_bin/pl/marbles_2_0_0_31.cab
c:\windows\Downloaded Program Files\Marbles.inf

c:\windows\Downloaded Program Files\wordssingle.dll - O16 -: {BFA1F11D-3121-AFE1-4112-983219421AEF}
hxxp://67.15.101.3/g_bin/pl/wordssingle_2_0_0_45.cab
c:\windows\Downloaded Program Files\wordssingle.inf

c:\windows\Downloaded Program Files\Slots80.dll - O16 -: {ECEAD8AE-01D6-11D5-9A39-0080C8D85044}
hxxp://67.15.101.3/g_bin/pl/slots80_2_0_0_33.cab
c:\windows\Downloaded Program Files\Slots80.inf

c:\windows\Downloaded Program Files\Billard14.dll - O16 -: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3}
hxxp://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
c:\windows\Downloaded Program Files\Billard14.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 14:28:47
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-796845957-117609710-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*C
]
@Class="Shell"

[HKEY_USERS\S-1-5-21-796845957-117609710-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*C
\OpenWithList]
@Class="Shell"
"a"="WINWORD.EXE"
"MRUList"="a"
.
Completion time: 2009-02-08 14:32:49 - machine was rebooted
ComboFix-quarantined-files.txt  2009-02-08 13:31:54

Pre-Run: 834 961 408 bajtów wolnych
Post-Run: 1,843,879,936 bajtów wolnych

231   --- E O F ---   2009-01-14 17:36:29


hijackthis

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:34:32, on 2009-02-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
E:\Anty\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\drivers\services.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InstantAccess] C:\Program Files\ScannerU\TBRIDGE\BIN\InstantAccess.exe /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\Program Files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe
O4 - HKLM\..\Run: [PDFCreatorClient] "C:\Program Files\PDFClient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\Program Files\ScannerU\TBRIDGE\BIN\RegisterDropHandler.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [plotvsvn.exe] C:\WINDOWS\plotvsvn.exe
O4 - HKCU\..\Run: [rzikcjex.exe] C:\WINDOWS\rzikcjex.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: userinit.exe
O4 - Global Startup: Action Manager 32.lnk = C:\Program Files\ScannerU\AM32.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Jaws PDF Creator Manual.lnk = C:\Program Files\manual.pdf
O4 - Global Startup: Jaws ToPDF.lnk = C:\Program Files\ToPDF.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {112857FE-03FF-11D5-9A3F-0080C8D85044} (GameDesire Solitaires) - http://67.15.101.3/g_bin/pl/solitaire_2_0_0_26.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab
O16 - DPF: {2A781DED-C22D-4153-9812-CEA98A32981C} (GameDesire Makao) - http://67.15.101.3/g_bin/pl/cardsmakao_2_0_0_26.cab
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_27.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160143371304
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160143360804
O16 - DPF: {881290B9-F53C-4676-8DAF-3DBEFC297308} (GameDesire Makao) - http://67.15.101.3/g_bin/pl/makao_2_0_0_22.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://kamera.vadso.kommune.no:187/activex/AxisCamControl.cab
O16 - DPF: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Pirate) - http://67.15.101.3/g_bin/pl/pirate_2_0_0_28.cab
O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/pl/marbles_2_0_0_31.cab
O16 - DPF: {BFA1F11D-3121-AFE1-4112-983219421AEF} (GameDesire 1Player Word Games) - http://67.15.101.3/g_bin/pl/wordssingle_2_0_0_45.cab
O16 - DPF: {ECEAD8AE-01D6-11D5-9A39-0080C8D85044} (GameDesire Slots 80th) - http://67.15.101.3/g_bin/pl/slots80_2_0_0_33.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C3} (GameDesire Pool 14) - http://67.15.101.3/g_bin/pl/billard14_2_0_0_30.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D10E5EE9-AB12-45E4-A538-9B097E618BEC}: NameServer = 194.204.159.1,194.204.152.34
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDFCreatorMessages - Global Graphics Software Ltd. - C:\WINDOWS\system32\PDFCreatorMessages.exe

--
End of file - 7959 bytes